A systems administrator has been alerted to a zero-day vulnerability that is impacting a service enabled on a server OS. Which of the following would work BEST to limit an attacker from exploiting this vulnerability?
Correct Answer: B. Closing open ports
Incorrect answer: NIDS - because the "D" stands for detection, not PREVENTION. NIDS would not stop an attack it would only generate an alert.
- Nothing in the question is asking to detect the zero day attack, so NIDS is not relevant. We already know about the attack.
- Nothing in the question is asking us to keep the service running with our action.
- There is a low probability that a patch will solve an issue of a zero day attack.
- Closing the port is the only option that can prevent malware traffic effecting the particular service.
B. Closing open ports. This option means blocking or disabling the network ports used by the service affected by the zero-day vulnerability. Closing open ports can work best to limit an attacker from exploiting the zero-day vulnerability, as it can prevent or reduce the exposure of the service to the network and reduce the attack surface. Closing open ports can also help to isolate the host from potential attacks and minimize the impact on other hosts or systems in the cluster.
But is not NIDS a "detection" system? The questions asks what is best to limit an attacker from exploiting the vulnerability, whereas a NIDS will simply tell you once it happened. In this case, answer B would be it (Assuming they are closing the specific ports utilized in the zero-day). A&C obviously are no good against zero-day.
upvoted 2 times
...
...
...
...
This section is not available anymore. Please use the main Exam Page.SK0-005 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
a792193
1 year, 1 month agohasquaati
1 year, 4 months agoMrS
1 year, 6 months agoRSMCT2011
2 years, 3 months agoRSMCT2011
2 years, 3 months agoDrewid91
2 years, 2 months agoObi_Wan_Jacoby
2 years ago